2

I want to do something like Facebook does. We can see any time where we're logged in. e.g.:

Windows PC · New Delhi, India Edge · Active now

Windows PC · New Delhi, India Chrome · 8 minutes ago

Xiaomi Redmi 4A · New Delhi, India Facebook app · 10 hours ago

Now, I have created a table in database that stores mainly user ID, a unique id and user agent.

Whoever logs in is saved in the table.

If a user logs in from 3 different devices, I see 3 entries for same use in table.

But, the problem I'm facing is, if I login again (when cookies are cleared or something like that), I see another entry in the table for same device. This is what I don't want and Facebook does handle it somehow. Facebook shows only one entry for a single user and device.

Now what I thought is to remove entry if same user logs in again and again (Without logging out: maybe clearing cookies or when session expired) with same browser / app and maintain a single entry.

But again, I don't know which row to delete. There may be a user logged in with 2 insanely same devices in same browser / app. Now how I can I remove entry of one of them?

Here's rows look like:

userId UniqueId UserAgent/Device
2          342     Samsung - Chrome
2          341     Windows PC - Chrome
2          345     Nokia Lumia 630 - Internet Explorer (actually logged in)
2          346     Nokia Lumia 630 - Internet Explorer (actually logged in)
2          360     Nokia Lumia 630 - Internet Explorer 
                   (Duplicate Entry because of re-login (Cookies cleared or session expired))
2          363     Nokia Lumia 630 - Internet Explorer
                   (Duplicate Entry because of re-login (Cookies cleared or session expired))
2          389     Nokia Lumia 630 - Internet Explorer
                   (Duplicate Entry because of re-login (Cookies cleared or session expired))
2          367     Nokia Lumia 630 - Internet Explorer
3          378     something
4          379     something

(User id 2 has 8 sessions)

Here's what I want:

2          342     Samsung - Chrome
2          341     Windows PC - Chrome
2          345     Nokia Lumia 630 - Internet Explorer
2          346     Nokia Lumia 630 - Internet Explorer
3          378     something
4          379     something

(User id 2 has 4 sessions)

Is what I'm trying to implement is a right approach or should I do something different?

EDIT: Fixed counts.

  • Store the session (token, code, key or whatever the client use for authorization) alongside with the userId. Make the registry expiration as long as the session is. This is quite straightforward to do with Redis. The web agent is useless at the time of identifying whether the user is one device or another due to we can fake these agents. – Laiv Feb 3 '18 at 17:24
  • The problem is how to prevent duplicate entries for a user when he makes login request again and again from same browser? (This is more of a developer side question) – Vikas Feb 3 '18 at 17:27
  • @Laiv please reply. – Vikas Feb 3 '18 at 17:32
  • Did the user log out first? Anyways, the thing is that you have no way to identify sessions. You are not storing that information so whether the user login or log out, you can not know. You still need something like a fingerprint. A bit of information the client sends every request. Also in the logout request. The server can invalidate the session and finally remove the entry from the DB due to this fingerprint. A new login, new "fingerprint" and so on. The fingerprint can be anything; the web agent's checksum, the auth token, the IP, a UUID, whatever you consider to be safe – Laiv Feb 3 '18 at 17:38
  • so your problem is that your current code does everything facebook does, unless the user deliberately deletes all their cookies/local data? – Ewan Feb 3 '18 at 18:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.